128006 - more selective "submission not encrypted" warnings

Status: RESOLVED WONTFIX

(Core Graveyard :: Security: UI, enhancement)

Description

[Michael Wardle]

build 2002022603 on Windows 2000

On a clean profile, Mozilla will bring up a dialog box warning the user that
this submission is not encrypted, and ask whether this sort of message should
appear again.

This is a really neat idea, but:
a) many web sites still don't have an encrypted version
b) the warning appears even for insensitive information

Because the existing dialog box appears so frequently (even when searching
Bugzilla), I disable it, however I would like to be reminded when I'm submitting
sensitive information such as a password or credit card information.

A relatively simple way of providing a happy middle ground (remembering that
most web sites that take credit card details and other highly-sensitive
information now have SSL), I propose that there is an alternative or
complementary dialog box that only appears when I'm sending a clear-text
password (i.e. whenever I'm submitting a form that used asterisks to mask my
input and the protocol is http).

Comment 1

[Chu Alan #2]

um .. although this is quite pratical, but will it confuse novice users more ?

Comment 2

[Boris Zbarsky [:bzbarsky]]

This seems like a good idea to me, actually....

Comment 3

[timeless]

uid is being phased out.

Comment 4

[John G. Myers]

Mass reassign ssaux bugs to nobody

Comment 5

[Dana Keeler (she/her) [:keeler]]

I think what we went with was a warning to the developer console, not a popup to everyday users. See tracking bug 1217142.